Security
Thirdpen acts in your apps, so it is built to ask before it acts, keep each piece of work apart, and remember only what it should.
Here’s the draft. It goes out once you allow it.
Sales wants to send email in Gmail
This runs in your connected Gmail account. Nothing happens until you allow it.
Send email · Gmail01 · Approvals
Thirdpen works in your apps, so it treats every change to the outside world as yours to approve.
Before it sends, posts, shares, invites, pays or deletes anything in a connected app, Thirdpen stops and shows you exactly what it will do. It runs only when you press Allow.
Read only, Ask, Auto, Auto-all. Reading and working in its own computer never need a card; changes to your apps follow the mode you choose.
For every connected app you decide whether agents may make changes, and separately whether they may delete.
An action Thirdpen cannot classify is treated as a change. The worst case is one card too many, never an action you did not see.
If you answer in the chat instead of pressing Allow, the waiting action is cancelled and never runs.
A routine runs with nobody watching, so the tools that create or change agents, skills and apps are switched off for scheduled runs.
02 · Isolation
Code, files and the browser for a thread run in a sandbox of their own, apart from every other thread.
Each thread gets its own sandboxed Linux container with its own browser. Nothing one thread runs can reach another.
When a site needs a password, a passkey, a CAPTCHA or a payment, the agent pauses and hands the browser to you.
The browser’s control port is never exposed to the internet. The live view reaches you only through your signed-in session.
Files you upload are always served as downloads and previewed in a sandbox, so a file can never run as a page on thirdpen.app.
03 · Privacy
Memory makes the next piece of work easier. It is kept narrow on purpose.
Only their creator can open them. They never appear in anyone’s list and are never written to memory.
What Thirdpen learns about you is stored separately from what each agent knows about its work, and the two are never searched together.
Other threads are visible to everyone in your workspace, so the team can pick up the work. Pins stay personal.
04 · Access
Who can change the workspace is decided by role, and checked on every request.
Workspace admins manage members, connected apps and the team’s skills. Only an app’s creator or an admin can delete it.
Sessions use signed cookies, and requests from another site that try to change data are rejected.
Password reset links expire after an hour.
05 · Providers
The services that process data to run Thirdpen, and what each one is for.
| Provider | Used for |
|---|---|
| Cloudflare | Hosting, database, file storage, sandboxed computers and email |
| Gemini, the AI models that do the work | |
| Composio | Connections to your work apps |
| Supermemory | Long-term memory |
| Parallel and Exa | Web search |
| Owostack | Usage metering |
06 · Report an issue
Email yaqeen@thirdpen.app with what you found and the steps to reproduce it. We will reply and keep you updated while we fix it.
Please give us a reasonable chance to fix it before you share it, and don’t access or change other people’s data while you test.